@spotify-confidence/csr-common 0.18.1 → 0.18.3

package/src/events.ts

@@ -224,6 +224,7 @@ export type FlagEvaluationPluginData = {
   payload: {
     flagKey: string;
     variant: string;
+    assignmentOrigin: string;
   };
 };
 

package/src/uploader/create-uploader.test.ts

@@ -0,0 +1,312 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { CreateUploaderOptions } from './types';
+
+vi.mock('./worker/worker-script', () => ({
+  workerScript: 'console.log("worker")',
+}));
+
+const DEFAULTS: CreateUploaderOptions = {
+  apiUrl: 'https://api.example',
+  clientSecret: 'secret',
+};
+
+function fakeSessionStorage(): Storage {
+  const store: Record<string, string> = {};
+  return {
+    getItem: (key: string) => store[key] ?? null,
+    setItem: (key: string, value: string) => {
+      store[key] = value;
+    },
+    removeItem: (key: string) => {
+      delete store[key];
+    },
+    clear: () => Object.keys(store).forEach(k => delete store[k]),
+    get length() {
+      return Object.keys(store).length;
+    },
+    key: (i: number) => Object.keys(store)[i] ?? null,
+  };
+}
+
+class StubWorker {
+  onerror: ((e: Event) => void) | null = null;
+  onmessage: ((e: MessageEvent) => void) | null = null;
+  postMessage() {}
+}
+
+function installWorkerStubs(opts?: { workerThrows?: boolean; sharedWorkerThrows?: boolean }) {
+  (globalThis as Record<string, unknown>).Worker = opts?.workerThrows
+    ? class {
+        constructor() {
+          throw new DOMException('Blocked', 'SecurityError');
+        }
+      }
+    : StubWorker;
+
+  if (opts?.sharedWorkerThrows) {
+    (globalThis as Record<string, unknown>).SharedWorker = class {
+      constructor() {
+        throw new DOMException('Blocked', 'SecurityError');
+      }
+    };
+  } else {
+    (globalThis as Record<string, unknown>).SharedWorker = class {
+      onerror: ((e: Event) => void) | null = null;
+      port = {
+        start() {},
+        onmessage: null as ((e: MessageEvent) => void) | null,
+        postMessage() {},
+      };
+    };
+  }
+}
+
+function tick() {
+  return new Promise(r => setTimeout(r, 0));
+}
+
+describe('createUploader', () => {
+  const blobUrls: string[] = [];
+
+  beforeEach(() => {
+    globalThis.sessionStorage = fakeSessionStorage();
+
+    if (!globalThis.crypto) {
+      (globalThis as Record<string, unknown>).crypto = {};
+    }
+    if (!globalThis.crypto.randomUUID) {
+      globalThis.crypto.randomUUID = () =>
+        '00000000-0000-0000-0000-000000000000' as `${string}-${string}-${string}-${string}-${string}`;
+    }
+    if (!globalThis.crypto.subtle?.digest) {
+      (globalThis.crypto as Record<string, unknown>).subtle = {
+        digest: async () => new ArrayBuffer(32),
+      };
+    }
+
+    vi.spyOn(URL, 'createObjectURL').mockImplementation(() => {
+      const url = `blob:http://localhost/${blobUrls.length}`;
+      blobUrls.push(url);
+      return url;
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    blobUrls.length = 0;
+    delete (globalThis as Record<string, unknown>).SharedWorker;
+  });
+
+  async function loadCreateUploader() {
+    vi.resetModules();
+    // .js extension is required by Node16 module resolution for dynamic imports
+    // (static `import` lines work without it because the package is CJS — see package.json).
+    // eslint-disable-next-line es/no-dynamic-import
+    const mod = await import('./create-uploader.js');
+    return mod.createUploader;
+  }
+
+  describe('blob: fallback', () => {
+    it('uses data: URL when Worker constructor succeeds', async () => {
+      installWorkerStubs();
+
+      const createUploader = await loadCreateUploader();
+      const logs: string[] = [];
+      createUploader({ ...DEFAULTS, workerMode: 'dedicated', debugLogger: m => logs.push(m) });
+      await tick();
+
+      expect(blobUrls).toHaveLength(0);
+      expect(logs.some(l => l.includes('via data'))).toBe(true);
+    });
+
+    it('falls back to blob: when data: Worker throws', async () => {
+      let constructedUrl: string | undefined;
+      (globalThis as Record<string, unknown>).Worker = class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage() {}
+        constructor(url: string) {
+          if (url.startsWith('data:')) {
+            throw new DOMException('Blocked', 'SecurityError');
+          }
+          constructedUrl = url;
+        }
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+      const logs: string[] = [];
+      createUploader({ ...DEFAULTS, workerMode: 'dedicated', debugLogger: m => logs.push(m) });
+      await tick();
+
+      expect(blobUrls).toHaveLength(1);
+      expect(constructedUrl).toBe(blobUrls[0]);
+      expect(logs.some(l => l.includes('falling back to blob:'))).toBe(true);
+      expect(logs.some(l => l.includes('via blob'))).toBe(true);
+    });
+
+    it('falls back to blob: dedicated worker when SharedWorker data: throws', async () => {
+      (globalThis as Record<string, unknown>).SharedWorker = class {
+        constructor() {
+          throw new DOMException('Blocked', 'SecurityError');
+        }
+      };
+      let constructedUrl: string | undefined;
+      (globalThis as Record<string, unknown>).Worker = class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage() {}
+        constructor(url: string) {
+          constructedUrl = url;
+        }
+      };
+
+      const createUploader = await loadCreateUploader();
+      const logs: string[] = [];
+      createUploader({ ...DEFAULTS, workerMode: 'shared', debugLogger: m => logs.push(m) });
+      await tick();
+
+      expect(blobUrls).toHaveLength(1);
+      expect(constructedUrl).toBe(blobUrls[0]);
+      expect(logs.some(l => l.includes('falling back to blob:'))).toBe(true);
+    });
+
+    it('falls back to blob: when SharedWorker onerror fires asynchronously (Chrome CSP)', async () => {
+      let constructedUrl: string | undefined;
+      (globalThis as Record<string, unknown>).SharedWorker = class {
+        onerror: ((e: Event) => void) | null = null;
+        port = {
+          start() {},
+          onmessage: null as ((e: MessageEvent) => void) | null,
+          postMessage() {},
+        };
+        constructor() {
+          setTimeout(() => this.onerror?.(new Event('error')), 0);
+        }
+      };
+      (globalThis as Record<string, unknown>).Worker = class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage() {}
+        constructor(url: string) {
+          constructedUrl = url;
+        }
+      };
+
+      const createUploader = await loadCreateUploader();
+      const logs: string[] = [];
+      // Await the full async chain: openWorkerPort detects the async onerror,
+      // falls back to blob, then createUploader eventually hits the welcome timeout.
+      const p = createUploader({
+        ...DEFAULTS,
+        workerMode: 'shared',
+        debugLogger: m => logs.push(m),
+        _welcomeTimeoutMs: 50,
+      });
+      await expect(p).rejects.toThrow(/welcome timeout/);
+
+      expect(blobUrls).toHaveLength(1);
+      expect(constructedUrl).toBe(blobUrls[0]);
+      expect(logs.some(l => l.includes('falling back to blob:'))).toBe(true);
+    });
+
+    it('throws with CSP hint when both data: and blob: are blocked', async () => {
+      (globalThis as Record<string, unknown>).Worker = class {
+        constructor() {
+          throw new DOMException('Blocked', 'SecurityError');
+        }
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+
+      await expect(createUploader({ ...DEFAULTS, workerMode: 'dedicated' })).rejects.toThrow(/worker-src/);
+    });
+
+    it('logs CSP hint via debugLogger when both data: and blob: are blocked', async () => {
+      (globalThis as Record<string, unknown>).Worker = class {
+        constructor() {
+          throw new DOMException('Blocked', 'SecurityError');
+        }
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+      const logs: string[] = [];
+
+      await expect(
+        createUploader({ ...DEFAULTS, workerMode: 'dedicated', debugLogger: m => logs.push(m) }),
+      ).rejects.toThrow();
+      expect(logs.some(l => l.includes('worker-load-failed') && l.includes('worker-src'))).toBe(true);
+    });
+
+    it('does not fall back when a custom workerUrl is provided', async () => {
+      (globalThis as Record<string, unknown>).Worker = class {
+        constructor() {
+          throw new Error('custom URL not found');
+        }
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+
+      await expect(
+        createUploader({ ...DEFAULTS, workerMode: 'dedicated', workerUrl: 'https://cdn.example/worker.js' }),
+      ).rejects.toThrow();
+      expect(blobUrls).toHaveLength(0);
+    });
+  });
+
+  describe('worker load failure (async error)', () => {
+    it('throws with CSP hint when dedicated Worker fires onerror', async () => {
+      (globalThis as Record<string, unknown>).Worker = class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage() {}
+        constructor() {
+          setTimeout(() => this.onerror?.(new Event('error')), 5);
+        }
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+
+      await expect(createUploader({ ...DEFAULTS, workerMode: 'dedicated' })).rejects.toThrow(/worker-src/);
+    });
+
+    it('throws with CSP hint when SharedWorker fires onerror', async () => {
+      (globalThis as Record<string, unknown>).SharedWorker = class {
+        onerror: ((e: Event) => void) | null = null;
+        port = {
+          start() {},
+          onmessage: null as ((e: MessageEvent) => void) | null,
+          postMessage() {},
+        };
+        constructor() {
+          setTimeout(() => this.onerror?.(new Event('error')), 5);
+        }
+      };
+
+      const createUploader = await loadCreateUploader();
+
+      await expect(createUploader({ ...DEFAULTS, workerMode: 'shared' })).rejects.toThrow(/worker-src/);
+    });
+  });
+
+  describe('welcome timeout', () => {
+    it('rejects when the worker never sends a welcome', async () => {
+      (globalThis as Record<string, unknown>).Worker = class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage() {}
+      };
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploader();
+
+      await expect(createUploader({ ...DEFAULTS, workerMode: 'dedicated', _welcomeTimeoutMs: 50 })).rejects.toThrow(
+        /welcome timeout/,
+      );
+    });
+  });
+});

package/src/uploader/create-uploader.ts

@@ -6,10 +6,12 @@ const STORAGE_TAB_ID = 'csr:tabId';
 const STORAGE_SESSION = 'csr:session';
 const STORAGE_COUNTER = 'csr:counter';
 const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000;
+const WELCOME_TIMEOUT_MS = 10_000;
 
 interface PortLike {
   postMessage(m: unknown): void;
   setHandler(cb: (data: unknown) => void): void;
+  onError(cb: (err: Error) => void): void;
 }
 
 interface WelcomeMessage {
@@ -49,7 +51,11 @@ export async function createUploader(opts: CreateUploaderOptions): Promise<Uploa
     } counterHint=${counterHint}`,
   );
 
-  const port = await openWorkerPort(mode, opts.clientSecret, opts.workerUrl);
+  const workerName = mode === 'shared' ? await hashSecret(opts.clientSecret) : undefined;
+  const { port, urlScheme } = await openWorkerPort(mode, opts.workerUrl, workerName, log);
+  log?.(
+    `tab: worker loaded via ${urlScheme}${urlScheme === 'blob' ? ' (fallback — cross-tab sharing unavailable)' : ''}`,
+  );
 
   // State accessible to both the message handler (for post-welcome state/dead messages)
   // and the post-welcome setup code below. Mutable so welcome can populate them.
@@ -118,14 +124,36 @@ export async function createUploader(opts: CreateUploaderOptions): Promise<Uploa
   });
   log?.('tab: hello sent, awaiting welcome');
 
-  const welcome = await welcomePromise;
+  const timeoutMs = opts._welcomeTimeoutMs ?? WELCOME_TIMEOUT_MS;
+  let welcomeTimer: ReturnType<typeof setTimeout> | undefined;
+  const welcomeDeadline = new Promise<never>((_, reject) => {
+    port.onError(err => reject(err));
+    welcomeTimer = setTimeout(
+      () =>
+        reject(
+          new Error(
+            'uploader: welcome timeout. The worker did not respond within ' +
+              `${timeoutMs / 1000}s. This may indicate a CSP policy blocking ` +
+              'the worker script from loading. Check your browser console for errors.',
+          ),
+        ),
+      timeoutMs,
+    );
+  });
+  welcomeDeadline.catch(() => {});
+  const welcome = await Promise.race([
+    welcomePromise.then(msg => {
+      clearTimeout(welcomeTimer);
+      return msg;
+    }),
+    welcomeDeadline,
+  ]);
   log?.(
     welcome.type === 'welcome'
       ? `tab: welcome (${'sessionId' in welcome.result ? `sessionId=${welcome.result.sessionId}` : 'skipRecording'})`
       : `tab: dead reason=${welcome.reason}`,
   );
   if (welcome.type === 'dead') {
-    // Worker died before establishing a session — surface the reason instead of swallowing it as `null`.
     throw new Error(`uploader: ${welcome.reason}`);
   }
   if ('skipRecording' in welcome.result) {
@@ -211,44 +239,117 @@ function resolveMode(mode: 'shared' | 'dedicated' | 'auto'): 'shared' | 'dedicat
   return mode;
 }
 
+type UrlScheme = 'data' | 'blob' | 'custom';
+
+interface InternalPort extends PortLike {
+  getBufferedError(): Error | null;
+}
+
 async function openWorkerPort(
   mode: 'shared' | 'dedicated',
-  clientSecret: string,
   workerUrl: string | undefined,
-): Promise<PortLike> {
-  // Default to a content-derived data URL: identical across tabs (so SharedWorker
-  // sharing works) and self-contained (no infrastructure for SDK consumers).
-  const url = workerUrl ?? toDataUrl(workerScript);
-
-  if (mode === 'shared') {
-    const name = await hashSecret(clientSecret);
-    // `extendedLifetime` keeps the SharedWorker alive across top-level navigations on
-    // Chrome 139+. No-op everywhere else. Cast required because the option isn't in the
-    // standard SharedWorker type yet.
-    const options = {
-      name,
-      type: 'module',
-      extendedLifetime: true,
-    } as WorkerOptions;
-    const worker = new SharedWorker(url, options);
-    worker.port.start();
-    return {
-      postMessage: m => worker.port.postMessage(m),
-      setHandler: cb => {
-        worker.port.onmessage = (e: MessageEvent) => cb(e.data);
-      },
-    };
+  workerName: string | undefined,
+  log: ((msg: string) => void) | undefined,
+): Promise<{ port: PortLike; urlScheme: UrlScheme }> {
+  if (workerUrl) {
+    return { port: createWorker(mode, workerUrl, workerName), urlScheme: 'custom' };
+  }
+
+  const dataUrl = toDataUrl(workerScript);
+  try {
+    const port = createWorker(mode, dataUrl, workerName);
+    // Chrome's SharedWorker doesn't throw synchronously for CSP blocks — it fires
+    // onerror asynchronously. Yield one macrotask to let it fire, then check.
+    await new Promise(resolve => setTimeout(resolve, 0));
+    const asyncErr = port.getBufferedError();
+    if (asyncErr) throw asyncErr;
+    return { port, urlScheme: 'data' };
+  } catch (_dataErr) {
+    log?.('tab: data: worker blocked, falling back to blob: URL (dedicated mode)');
+    const blobUrl = toBlobUrl(workerScript);
+    try {
+      return { port: createDedicatedWorker(blobUrl), urlScheme: 'blob' };
+    } catch (blobErr) {
+      const hint =
+        'Your Content Security Policy blocks both `data:` and `blob:` in `worker-src`. ' +
+        'To fix this, either add `blob:` to your `worker-src` directive, or ' +
+        'use the `workerUrl` option to serve the worker script from your own origin.';
+      log?.(`tab: worker-load-failed: ${hint}`);
+      throw new Error(`worker-load-failed: ${hint}`, blobErr instanceof Error ? { cause: blobErr } : undefined);
+    }
   }
+}
+
+function createWorker(mode: 'shared' | 'dedicated', url: string, workerName: string | undefined): InternalPort {
+  if (mode === 'shared') return createSharedWorker(url, workerName!);
+  return createDedicatedWorker(url);
+}
+
+function createSharedWorker(url: string, name: string): InternalPort {
+  const options = {
+    name,
+    type: 'module',
+    extendedLifetime: true,
+  } as WorkerOptions;
+  const worker = new SharedWorker(url, options);
+  let errorCb: ((err: Error) => void) | null = null;
+  let bufferedError: Error | null = null;
 
+  worker.onerror = e => {
+    const err = workerLoadError(e, url);
+    if (errorCb) errorCb(err);
+    else bufferedError = err;
+  };
+  worker.port.start();
+  return {
+    postMessage: m => worker.port.postMessage(m),
+    setHandler: cb => {
+      worker.port.onmessage = (e: MessageEvent) => cb(e.data);
+    },
+    onError: cb => {
+      errorCb = cb;
+      if (bufferedError) cb(bufferedError);
+    },
+    getBufferedError: () => bufferedError,
+  };
+}
+
+function createDedicatedWorker(url: string): InternalPort {
   const worker = new Worker(url, { type: 'module' });
+  let errorCb: ((err: Error) => void) | null = null;
+  let bufferedError: Error | null = null;
+
+  worker.onerror = e => {
+    const err = workerLoadError(e, url);
+    if (errorCb) errorCb(err);
+    else bufferedError = err;
+  };
   return {
     postMessage: m => worker.postMessage(m),
     setHandler: cb => {
       worker.onmessage = (e: MessageEvent) => cb(e.data);
     },
+    onError: cb => {
+      errorCb = cb;
+      if (bufferedError) cb(bufferedError);
+    },
+    getBufferedError: () => bufferedError,
   };
 }
 
+function workerLoadError(cause: unknown, url: string): Error {
+  const isDataUrl = url.startsWith('data:');
+  const hint = isDataUrl
+    ? 'This is likely caused by a Content Security Policy (CSP) that blocks `data:` in ' +
+      '`worker-src`. To fix this, either add `data:` to your `worker-src` directive, or ' +
+      'use the `workerUrl` option to serve the worker script from your own origin.'
+    : `Failed to load the worker script from ${url}. Check that the URL is reachable and ` +
+      'that your CSP `worker-src` directive allows it.';
+
+  const msg = `worker-load-failed: ${hint}`;
+  return new Error(msg, cause instanceof Error ? { cause } : undefined);
+}
+
 function toDataUrl(script: string): string {
   // UTF-8-safe base64. The worker bundle is ASCII today but esbuild may emit non-ASCII
   // identifiers if the source ever contains them; this avoids `btoa` choking.
@@ -258,6 +359,10 @@ function toDataUrl(script: string): string {
   return `data:application/javascript;base64,${btoa(binary)}`;
 }
 
+function toBlobUrl(script: string): string {
+  return URL.createObjectURL(new Blob([script], { type: 'application/javascript' }));
+}
+
 async function hashSecret(secret: string): Promise<string> {
   const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));
   return Array.from(new Uint8Array(buf))

package/src/uploader/types.ts

@@ -59,6 +59,8 @@ export interface CreateUploaderOptions {
    * Worker messages are forwarded over the port and tagged so you can tell them apart.
    */
   debugLogger?: (msg: string) => void;
+  /** @internal Override the welcome-handshake timeout for testing. */
+  _welcomeTimeoutMs?: number;
 }
 
 // --- Internal types: used across the worker / tab pieces, not part of the public API. ---

package/src/uploader/worker/csr-client.test.ts

@@ -95,6 +95,18 @@ describe('CsrClient.openTransport', () => {
     await expect(client.openTransport('tok')).resolves.toBeDefined();
   });
 
+  it('redacts session_token from debug log', async () => {
+    installMockWsServer('wss://api/sessions/stream?session_token=secret-tok');
+
+    const logs: string[] = [];
+    const client = new CsrClient('https://api', 'secret', undefined, undefined, msg => logs.push(msg));
+    await client.openTransport('secret-tok');
+
+    expect(logs).toHaveLength(1);
+    expect(logs[0]).toContain('session_token=[REDACTED]');
+    expect(logs[0]).not.toContain('secret-tok');
+  });
+
   it('URL-encodes the session token', async () => {
     installMockWsServer('wss://api/sessions/stream?session_token=tok%2Fwith%3Dspecials');
 

package/src/uploader/worker/csr-client.ts

@@ -47,7 +47,7 @@ export class CsrClient implements Client {
     const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;
     const sep = wsBase.includes('?') ? '&' : '?';
     const url = `${wsBase}${sep}session_token=${encodeURIComponent(sessionToken)}`;
-    this.log(`WebSocket connect ${url}`);
+    this.log(`WebSocket connect ${url.replace(/session_token=[^&]*/, 'session_token=[REDACTED]')}`);
     const transport = new WebSocketTransport(url);
     await transport.ready();
     return transport;

package/src/uploader/worker/worker-script.ts

@@ -1,3 +1,3 @@
 // Generated by scripts/build-worker.mjs at build time. Do not edit.
 // Run `yarn workspace @spotify-confidence/csr-common build:worker` to regenerate.
-export const workerScript: string = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n\turl;\n\tws = null;\n\tonCloseCb = null;\n\tonStateChangeCb = null;\n\tintentionallyClosed = false;\n\tdead = false;\n\t/** Frames buffered while a (re)connect is in progress. */\n\tpending = [];\n\treadyPromise;\n\tconstructor(url) {\n\t\tthis.url = url;\n\t\tthis.readyPromise = new Promise((resolve, reject) => {\n\t\t\tthis.connect(false, resolve, reject);\n\t\t});\n\t\tthis.readyPromise.catch(() => {});\n\t}\n\tready() {\n\t\treturn this.readyPromise;\n\t}\n\tsend(frame) {\n\t\tif (this.dead || this.intentionallyClosed) return;\n\t\tif (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n\t\telse this.pending.push(frame);\n\t}\n\tclose(reason = \"transport-close\") {\n\t\tthis.intentionallyClosed = true;\n\t\tthis.ws?.close(1e3, reason);\n\t}\n\tonClose(cb) {\n\t\tthis.onCloseCb = cb;\n\t}\n\tonStateChange(cb) {\n\t\tthis.onStateChangeCb = cb;\n\t}\n\tconnect(isReconnect, onReady, onReadyFail) {\n\t\tconst ws = new WebSocket(this.url);\n\t\tthis.ws = ws;\n\t\tlet opened = false;\n\t\tws.onopen = () => {\n\t\t\topened = true;\n\t\t\tonReady?.();\n\t\t\tif (isReconnect) this.onStateChangeCb?.({ connected: true });\n\t\t\twhile (this.pending.length > 0) {\n\t\t\t\tconst f = this.pending.shift();\n\t\t\t\tws.send(JSON.stringify(f));\n\t\t\t}\n\t\t};\n\t\tws.onclose = (event) => {\n\t\t\tif (this.intentionallyClosed) return;\n\t\t\tif (!opened) {\n\t\t\t\tconst reason = `${isReconnect ? \"reconnect\" : \"initial\"}-failed code=${event.code}`;\n\t\t\t\tif (onReadyFail) {\n\t\t\t\t\tonReadyFail(new Error(reason));\n\t\t\t\t\tthis.dead = true;\n\t\t\t\t} else this.die(reason);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n\t\t\t\tthis.onStateChangeCb?.({ connected: false });\n\t\t\t\tthis.connect(true);\n\t\t\t} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n\t\t};\n\t}\n\tdie(reason) {\n\t\tthis.dead = true;\n\t\tthis.onCloseCb?.({ reason });\n\t}\n};\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n\tapiUrl;\n\tclientSecret;\n\tcontext;\n\twebsocketUrl;\n\tlog;\n\tforceRecord;\n\tconstructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n\t\tthis.apiUrl = apiUrl;\n\t\tthis.clientSecret = clientSecret;\n\t\tthis.context = context;\n\t\tthis.websocketUrl = websocketUrl;\n\t\tthis.log = log;\n\t\tthis.forceRecord = forceRecord;\n\t}\n\tasync initSession() {\n\t\tconst url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n\t\tthis.log(`fetch POST ${url}`);\n\t\tconst res = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tclientSecret: this.clientSecret,\n\t\t\t\t...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n\t\t\t\t...this.forceRecord ? { forceRecord: true } : {}\n\t\t\t})\n\t\t});\n\t\tif (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n\t\tconst data = await res.json();\n\t\tif (data.skipRecording) return { skipRecording: true };\n\t\tif (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n\t\treturn {\n\t\t\tsessionId: data.sessionId,\n\t\t\tsessionToken: data.sessionToken\n\t\t};\n\t}\n\tasync openTransport(sessionToken) {\n\t\tconst wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n\t\tconst url = `${wsBase}${wsBase.includes(\"?\") ? \"&\" : \"?\"}session_token=${encodeURIComponent(sessionToken)}`;\n\t\tthis.log(`WebSocket connect ${url}`);\n\t\tconst transport = new WebSocketTransport(url);\n\t\tawait transport.ready();\n\t\treturn transport;\n\t}\n\ttrimSlash(s) {\n\t\treturn s.endsWith(\"/\") ? s.slice(0, -1) : s;\n\t}\n\ttoWsScheme(base) {\n\t\tif (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n\t\tif (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n\t\treturn base;\n\t}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n\tif (idleTimer !== null) {\n\t\tclearTimeout(idleTimer);\n\t\tidleTimer = null;\n\t}\n}\nfunction log(msg) {\n\tfor (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n\t\ttype: \"log\",\n\t\tmsg\n\t});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n\tcancelIdleTimer();\n\tconst handle = {\n\t\tport: adapter,\n\t\thello: null,\n\t\tdebugLogs: false\n\t};\n\tports.push(handle);\n\tadapter.onmessage((data) => {\n\t\thandleMessage(handle, data);\n\t});\n}\nfunction handleMessage(handle, message) {\n\tswitch (message.type) {\n\t\tcase \"hello\":\n\t\t\thandle.hello = message;\n\t\t\thandle.debugLogs = message.debugLogs ?? false;\n\t\t\tif (rejectIfIncompatible(handle)) return;\n\t\t\tif (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n\t\t\tonHello(handle);\n\t\t\treturn;\n\t\tcase \"frame\":\n\t\t\tonFrame(message.frame);\n\t\t\treturn;\n\t\tcase \"bye\":\n\t\t\tonBye(handle);\n\t\t\treturn;\n\t\tdefault: break;\n\t}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n\tif (lockedConfig === null) return false;\n\tconst incoming = handle.hello;\n\tif (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n\thandle.port.postMessage({\n\t\ttype: \"dead\",\n\t\treason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n\t});\n\tconst idx = ports.indexOf(handle);\n\tif (idx >= 0) ports.splice(idx, 1);\n\treturn true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n\tconst tabId = handle.hello.tabId;\n\tif (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n\tconst fresh = crypto.randomUUID();\n\thandle.newTabId = fresh;\n\thandle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n\tswitch (state.phase) {\n\t\tcase \"init\":\n\t\t\tlockedConfig = {\n\t\t\t\tapiUrl: handle.hello.apiUrl,\n\t\t\t\twebsocketUrl: handle.hello.websocketUrl,\n\t\t\t\tclientSecret: handle.hello.clientSecret\n\t\t\t};\n\t\t\tlog(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ?? \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n\t\t\tstate = { phase: \"initializing\" };\n\t\t\tinitializeSession(handle.hello).then(flushPendingWelcomes);\n\t\t\treturn;\n\t\tcase \"initializing\": return;\n\t\tcase \"active\":\n\t\t\tsendActiveWelcome(handle, state.sessionId, state.sessionToken);\n\t\t\treturn;\n\t\tcase \"idle\": {\n\t\t\tconst { client, sessionId, sessionToken } = state;\n\t\t\tstate = { phase: \"initializing\" };\n\t\t\tresumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n\t\t\treturn;\n\t\t}\n\t\tcase \"skipping\":\n\t\t\tif (handle.hello.forceRecord) {\n\t\t\t\tlog(\"forceRecord set; re-initializing from skipping state\");\n\t\t\t\tstate = { phase: \"initializing\" };\n\t\t\t\tinitializeSession(handle.hello).then(flushPendingWelcomes);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\thandle.port.postMessage({\n\t\t\t\ttype: \"welcome\",\n\t\t\t\tresult: { skipRecording: true }\n\t\t\t});\n\t\t\treturn;\n\t\tcase \"dead\":\n\t\t\thandle.port.postMessage({\n\t\t\t\ttype: \"dead\",\n\t\t\t\treason: state.reason\n\t\t\t});\n\t\t\treturn;\n\t\tdefault: break;\n\t}\n}\nasync function initializeSession(firstHello) {\n\tconst client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n\tif (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n\t\tlog(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n\t\ttry {\n\t\t\tconst transport = await client.openTransport(firstHello.sessionTokenHint);\n\t\t\twireTransport(transport);\n\t\t\tstate = {\n\t\t\t\tphase: \"active\",\n\t\t\t\tclient,\n\t\t\t\ttransport,\n\t\t\t\tsessionId: firstHello.sessionIdHint,\n\t\t\t\tsessionToken: firstHello.sessionTokenHint\n\t\t\t};\n\t\t\tlog(\"hint adopted; transport open\");\n\t\t\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n\t\t\treturn;\n\t\t} catch (err) {\n\t\t\tlog(`hint rejected (${String(err)}); falling back to fresh init`);\n\t\t}\n\t}\n\tlet result;\n\ttry {\n\t\tresult = await client.initSession();\n\t} catch (err) {\n\t\tlog(`init-session threw: ${String(err)}`);\n\t\ttransitionToDead(`init-session-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\tif (\"skipRecording\" in result) {\n\t\tlog(\"init-session: skipRecording\");\n\t\tstate = { phase: \"skipping\" };\n\t\treturn;\n\t}\n\tlog(`init-session ok sessionId=${result.sessionId}`);\n\tlet transport;\n\ttry {\n\t\ttransport = await client.openTransport(result.sessionToken);\n\t} catch (err) {\n\t\tlog(`openTransport threw: ${String(err)}`);\n\t\ttransitionToDead(`open-transport-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\twireTransport(transport);\n\tlog(\"transport open; session active\");\n\tstate = {\n\t\tphase: \"active\",\n\t\tclient,\n\t\ttransport,\n\t\tsessionId: result.sessionId,\n\t\tsessionToken: result.sessionToken\n\t};\n\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n\tlog(\"resuming transport from idle\");\n\tlet transport;\n\ttry {\n\t\ttransport = await client.openTransport(sessionToken);\n\t} catch (err) {\n\t\tlog(`resume-transport threw: ${String(err)}`);\n\t\ttransitionToDead(`resume-transport-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\twireTransport(transport);\n\tlog(\"transport resumed\");\n\tstate = {\n\t\tphase: \"active\",\n\t\tclient,\n\t\ttransport,\n\t\tsessionId,\n\t\tsessionToken\n\t};\n\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n\ttransport.onClose((info) => {\n\t\tif (state.phase !== \"active\") return;\n\t\ttransitionToDead(info.reason);\n\t});\n\ttransport.onStateChange((info) => {\n\t\tif (state.phase !== \"active\") return;\n\t\tfor (const handle of ports) handle.port.postMessage({\n\t\t\ttype: \"state\",\n\t\t\tconnected: info.connected\n\t\t});\n\t});\n}\nfunction transitionToDead(reason) {\n\tstate = {\n\t\tphase: \"dead\",\n\t\treason\n\t};\n\tfor (const handle of ports) handle.port.postMessage({\n\t\ttype: \"dead\",\n\t\treason\n\t});\n}\nfunction flushPendingWelcomes() {\n\tfor (const handle of ports) {\n\t\tif (handle.hello === null) continue;\n\t\tif (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n\t\telse if (state.phase === \"skipping\") handle.port.postMessage({\n\t\t\ttype: \"welcome\",\n\t\t\tresult: { skipRecording: true }\n\t\t});\n\t\telse if (state.phase === \"dead\") handle.port.postMessage({\n\t\t\ttype: \"dead\",\n\t\t\treason: state.reason\n\t\t});\n\t}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n\tconst hint = handle.hello?.sessionIdHint;\n\tconst adopted = hint !== void 0 && hint !== currentSessionId;\n\tconst newTabId = handle.newTabId;\n\thandle.port.postMessage({\n\t\ttype: \"welcome\",\n\t\tresult: {\n\t\t\tsessionId: currentSessionId,\n\t\t\tsessionToken: currentSessionToken\n\t\t},\n\t\tadoptedFromSessionId: adopted ? hint : void 0,\n\t\tnewTabId,\n\t\tresetCounter: adopted || newTabId !== void 0\n\t});\n}\nfunction onFrame(frame) {\n\tif (state.phase !== \"active\") return;\n\tstate.transport.send(frame);\n}\nfunction onBye(handle) {\n\tconst idx = ports.indexOf(handle);\n\tif (idx >= 0) ports.splice(idx, 1);\n\tif (ports.length === 0 && state.phase === \"active\") {\n\t\tlog(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n\t\tidleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n\t}\n}\nfunction enterIdle() {\n\tidleTimer = null;\n\tif (state.phase !== \"active\" || ports.length > 0) return;\n\tlog(\"idle timeout; closing transport\");\n\tstate.transport.close(\"idle\");\n\tstate = {\n\t\tphase: \"idle\",\n\t\tclient: state.client,\n\t\tsessionId: state.sessionId,\n\t\tsessionToken: state.sessionToken\n\t};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n\tconst port = event.ports[0];\n\tport.start();\n\tregisterPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n\treturn {\n\t\tpostMessage: (message) => port.postMessage(message),\n\t\tonmessage: (cb) => {\n\t\t\tport.onmessage = (e) => cb(e.data);\n\t\t}\n\t};\n}\nfunction adaptDedicatedSelf() {\n\tconst ws = self;\n\treturn {\n\t\tpostMessage: (message) => ws.postMessage(message),\n\t\tonmessage: (cb) => {\n\t\t\tws.onmessage = (e) => cb(e.data);\n\t\t}\n\t};\n}\n//#endregion\n";
+export const workerScript: string = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n\turl;\n\tws = null;\n\tonCloseCb = null;\n\tonStateChangeCb = null;\n\tintentionallyClosed = false;\n\tdead = false;\n\t/** Frames buffered while a (re)connect is in progress. */\n\tpending = [];\n\treadyPromise;\n\tconstructor(url) {\n\t\tthis.url = url;\n\t\tthis.readyPromise = new Promise((resolve, reject) => {\n\t\t\tthis.connect(false, resolve, reject);\n\t\t});\n\t\tthis.readyPromise.catch(() => {});\n\t}\n\tready() {\n\t\treturn this.readyPromise;\n\t}\n\tsend(frame) {\n\t\tif (this.dead || this.intentionallyClosed) return;\n\t\tif (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n\t\telse this.pending.push(frame);\n\t}\n\tclose(reason = \"transport-close\") {\n\t\tthis.intentionallyClosed = true;\n\t\tthis.ws?.close(1e3, reason);\n\t}\n\tonClose(cb) {\n\t\tthis.onCloseCb = cb;\n\t}\n\tonStateChange(cb) {\n\t\tthis.onStateChangeCb = cb;\n\t}\n\tconnect(isReconnect, onReady, onReadyFail) {\n\t\tconst ws = new WebSocket(this.url);\n\t\tthis.ws = ws;\n\t\tlet opened = false;\n\t\tws.onopen = () => {\n\t\t\topened = true;\n\t\t\tonReady?.();\n\t\t\tif (isReconnect) this.onStateChangeCb?.({ connected: true });\n\t\t\twhile (this.pending.length > 0) {\n\t\t\t\tconst f = this.pending.shift();\n\t\t\t\tws.send(JSON.stringify(f));\n\t\t\t}\n\t\t};\n\t\tws.onclose = (event) => {\n\t\t\tif (this.intentionallyClosed) return;\n\t\t\tif (!opened) {\n\t\t\t\tconst reason = `${isReconnect ? \"reconnect\" : \"initial\"}-failed code=${event.code}`;\n\t\t\t\tif (onReadyFail) {\n\t\t\t\t\tonReadyFail(new Error(reason));\n\t\t\t\t\tthis.dead = true;\n\t\t\t\t} else this.die(reason);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n\t\t\t\tthis.onStateChangeCb?.({ connected: false });\n\t\t\t\tthis.connect(true);\n\t\t\t} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n\t\t};\n\t}\n\tdie(reason) {\n\t\tthis.dead = true;\n\t\tthis.onCloseCb?.({ reason });\n\t}\n};\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n\tapiUrl;\n\tclientSecret;\n\tcontext;\n\twebsocketUrl;\n\tlog;\n\tforceRecord;\n\tconstructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n\t\tthis.apiUrl = apiUrl;\n\t\tthis.clientSecret = clientSecret;\n\t\tthis.context = context;\n\t\tthis.websocketUrl = websocketUrl;\n\t\tthis.log = log;\n\t\tthis.forceRecord = forceRecord;\n\t}\n\tasync initSession() {\n\t\tconst url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n\t\tthis.log(`fetch POST ${url}`);\n\t\tconst res = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tclientSecret: this.clientSecret,\n\t\t\t\t...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n\t\t\t\t...this.forceRecord ? { forceRecord: true } : {}\n\t\t\t})\n\t\t});\n\t\tif (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n\t\tconst data = await res.json();\n\t\tif (data.skipRecording) return { skipRecording: true };\n\t\tif (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n\t\treturn {\n\t\t\tsessionId: data.sessionId,\n\t\t\tsessionToken: data.sessionToken\n\t\t};\n\t}\n\tasync openTransport(sessionToken) {\n\t\tconst wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n\t\tconst url = `${wsBase}${wsBase.includes(\"?\") ? \"&\" : \"?\"}session_token=${encodeURIComponent(sessionToken)}`;\n\t\tthis.log(`WebSocket connect ${url.replace(/session_token=[^&]*/, \"session_token=[REDACTED]\")}`);\n\t\tconst transport = new WebSocketTransport(url);\n\t\tawait transport.ready();\n\t\treturn transport;\n\t}\n\ttrimSlash(s) {\n\t\treturn s.endsWith(\"/\") ? s.slice(0, -1) : s;\n\t}\n\ttoWsScheme(base) {\n\t\tif (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n\t\tif (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n\t\treturn base;\n\t}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n\tif (idleTimer !== null) {\n\t\tclearTimeout(idleTimer);\n\t\tidleTimer = null;\n\t}\n}\nfunction log(msg) {\n\tfor (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n\t\ttype: \"log\",\n\t\tmsg\n\t});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n\tcancelIdleTimer();\n\tconst handle = {\n\t\tport: adapter,\n\t\thello: null,\n\t\tdebugLogs: false\n\t};\n\tports.push(handle);\n\tadapter.onmessage((data) => {\n\t\thandleMessage(handle, data);\n\t});\n}\nfunction handleMessage(handle, message) {\n\tswitch (message.type) {\n\t\tcase \"hello\":\n\t\t\thandle.hello = message;\n\t\t\thandle.debugLogs = message.debugLogs ?? false;\n\t\t\tif (rejectIfIncompatible(handle)) return;\n\t\t\tif (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n\t\t\tonHello(handle);\n\t\t\treturn;\n\t\tcase \"frame\":\n\t\t\tonFrame(message.frame);\n\t\t\treturn;\n\t\tcase \"bye\":\n\t\t\tonBye(handle);\n\t\t\treturn;\n\t\tdefault: break;\n\t}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n\tif (lockedConfig === null) return false;\n\tconst incoming = handle.hello;\n\tif (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n\thandle.port.postMessage({\n\t\ttype: \"dead\",\n\t\treason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n\t});\n\tconst idx = ports.indexOf(handle);\n\tif (idx >= 0) ports.splice(idx, 1);\n\treturn true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n\tconst tabId = handle.hello.tabId;\n\tif (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n\tconst fresh = crypto.randomUUID();\n\thandle.newTabId = fresh;\n\thandle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n\tswitch (state.phase) {\n\t\tcase \"init\":\n\t\t\tlockedConfig = {\n\t\t\t\tapiUrl: handle.hello.apiUrl,\n\t\t\t\twebsocketUrl: handle.hello.websocketUrl,\n\t\t\t\tclientSecret: handle.hello.clientSecret\n\t\t\t};\n\t\t\tlog(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ?? \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n\t\t\tstate = { phase: \"initializing\" };\n\t\t\tinitializeSession(handle.hello).then(flushPendingWelcomes);\n\t\t\treturn;\n\t\tcase \"initializing\": return;\n\t\tcase \"active\":\n\t\t\tsendActiveWelcome(handle, state.sessionId, state.sessionToken);\n\t\t\treturn;\n\t\tcase \"idle\": {\n\t\t\tconst { client, sessionId, sessionToken } = state;\n\t\t\tstate = { phase: \"initializing\" };\n\t\t\tresumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n\t\t\treturn;\n\t\t}\n\t\tcase \"skipping\":\n\t\t\tif (handle.hello.forceRecord) {\n\t\t\t\tlog(\"forceRecord set; re-initializing from skipping state\");\n\t\t\t\tstate = { phase: \"initializing\" };\n\t\t\t\tinitializeSession(handle.hello).then(flushPendingWelcomes);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\thandle.port.postMessage({\n\t\t\t\ttype: \"welcome\",\n\t\t\t\tresult: { skipRecording: true }\n\t\t\t});\n\t\t\treturn;\n\t\tcase \"dead\":\n\t\t\thandle.port.postMessage({\n\t\t\t\ttype: \"dead\",\n\t\t\t\treason: state.reason\n\t\t\t});\n\t\t\treturn;\n\t\tdefault: break;\n\t}\n}\nasync function initializeSession(firstHello) {\n\tconst client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n\tif (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n\t\tlog(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n\t\ttry {\n\t\t\tconst transport = await client.openTransport(firstHello.sessionTokenHint);\n\t\t\twireTransport(transport);\n\t\t\tstate = {\n\t\t\t\tphase: \"active\",\n\t\t\t\tclient,\n\t\t\t\ttransport,\n\t\t\t\tsessionId: firstHello.sessionIdHint,\n\t\t\t\tsessionToken: firstHello.sessionTokenHint\n\t\t\t};\n\t\t\tlog(\"hint adopted; transport open\");\n\t\t\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n\t\t\treturn;\n\t\t} catch (err) {\n\t\t\tlog(`hint rejected (${String(err)}); falling back to fresh init`);\n\t\t}\n\t}\n\tlet result;\n\ttry {\n\t\tresult = await client.initSession();\n\t} catch (err) {\n\t\tlog(`init-session threw: ${String(err)}`);\n\t\ttransitionToDead(`init-session-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\tif (\"skipRecording\" in result) {\n\t\tlog(\"init-session: skipRecording\");\n\t\tstate = { phase: \"skipping\" };\n\t\treturn;\n\t}\n\tlog(`init-session ok sessionId=${result.sessionId}`);\n\tlet transport;\n\ttry {\n\t\ttransport = await client.openTransport(result.sessionToken);\n\t} catch (err) {\n\t\tlog(`openTransport threw: ${String(err)}`);\n\t\ttransitionToDead(`open-transport-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\twireTransport(transport);\n\tlog(\"transport open; session active\");\n\tstate = {\n\t\tphase: \"active\",\n\t\tclient,\n\t\ttransport,\n\t\tsessionId: result.sessionId,\n\t\tsessionToken: result.sessionToken\n\t};\n\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n\tlog(\"resuming transport from idle\");\n\tlet transport;\n\ttry {\n\t\ttransport = await client.openTransport(sessionToken);\n\t} catch (err) {\n\t\tlog(`resume-transport threw: ${String(err)}`);\n\t\ttransitionToDead(`resume-transport-failed: ${String(err)}`);\n\t\treturn;\n\t}\n\twireTransport(transport);\n\tlog(\"transport resumed\");\n\tstate = {\n\t\tphase: \"active\",\n\t\tclient,\n\t\ttransport,\n\t\tsessionId,\n\t\tsessionToken\n\t};\n\tif (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n\ttransport.onClose((info) => {\n\t\tif (state.phase !== \"active\") return;\n\t\ttransitionToDead(info.reason);\n\t});\n\ttransport.onStateChange((info) => {\n\t\tif (state.phase !== \"active\") return;\n\t\tfor (const handle of ports) handle.port.postMessage({\n\t\t\ttype: \"state\",\n\t\t\tconnected: info.connected\n\t\t});\n\t});\n}\nfunction transitionToDead(reason) {\n\tstate = {\n\t\tphase: \"dead\",\n\t\treason\n\t};\n\tfor (const handle of ports) handle.port.postMessage({\n\t\ttype: \"dead\",\n\t\treason\n\t});\n}\nfunction flushPendingWelcomes() {\n\tfor (const handle of ports) {\n\t\tif (handle.hello === null) continue;\n\t\tif (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n\t\telse if (state.phase === \"skipping\") handle.port.postMessage({\n\t\t\ttype: \"welcome\",\n\t\t\tresult: { skipRecording: true }\n\t\t});\n\t\telse if (state.phase === \"dead\") handle.port.postMessage({\n\t\t\ttype: \"dead\",\n\t\t\treason: state.reason\n\t\t});\n\t}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n\tconst hint = handle.hello?.sessionIdHint;\n\tconst adopted = hint !== void 0 && hint !== currentSessionId;\n\tconst newTabId = handle.newTabId;\n\thandle.port.postMessage({\n\t\ttype: \"welcome\",\n\t\tresult: {\n\t\t\tsessionId: currentSessionId,\n\t\t\tsessionToken: currentSessionToken\n\t\t},\n\t\tadoptedFromSessionId: adopted ? hint : void 0,\n\t\tnewTabId,\n\t\tresetCounter: adopted || newTabId !== void 0\n\t});\n}\nfunction onFrame(frame) {\n\tif (state.phase !== \"active\") return;\n\tstate.transport.send(frame);\n}\nfunction onBye(handle) {\n\tconst idx = ports.indexOf(handle);\n\tif (idx >= 0) ports.splice(idx, 1);\n\tif (ports.length === 0 && state.phase === \"active\") {\n\t\tlog(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n\t\tidleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n\t}\n}\nfunction enterIdle() {\n\tidleTimer = null;\n\tif (state.phase !== \"active\" || ports.length > 0) return;\n\tlog(\"idle timeout; closing transport\");\n\tstate.transport.close(\"idle\");\n\tstate = {\n\t\tphase: \"idle\",\n\t\tclient: state.client,\n\t\tsessionId: state.sessionId,\n\t\tsessionToken: state.sessionToken\n\t};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n\tconst port = event.ports[0];\n\tport.start();\n\tregisterPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n\treturn {\n\t\tpostMessage: (message) => port.postMessage(message),\n\t\tonmessage: (cb) => {\n\t\t\tport.onmessage = (e) => cb(e.data);\n\t\t}\n\t};\n}\nfunction adaptDedicatedSelf() {\n\tconst ws = self;\n\treturn {\n\t\tpostMessage: (message) => ws.postMessage(message),\n\t\tonmessage: (cb) => {\n\t\t\tws.onmessage = (e) => cb(e.data);\n\t\t}\n\t};\n}\n//#endregion\n";